netinet6: honor blackhole/unreach routes in the non-fastforwading code.
Currently, under the conditions specified below, IPv6 ingress packet processing can ignore blackhole/reject flag on the prefix. The packet will instead be looped locally till TTL expiration and a single ICMPv6 unreachable message will be send to the source even in case of RTF_BLACKHOLE. The following conditions needs hold to make the scenario happen: * IPv6 forwarding is enabled * Packet is not fast-forwarded * Destination prefix has either RTF_BLACKHOLE or RTF_REJECT flag Fix this behavior by checking for the blackhole/reject flags in ip6_forward(). Reported by: Dmitriy Smirnov <fox@sage.su> Reviewed by: ae Differential Revision: https://reviews.freebsd.org/D38164 MFC after: 3 days
This commit is contained in:
parent
7a56009cf5
commit
30dd227cff
@ -196,6 +196,15 @@ ip6_forward(struct mbuf *m, int srcrt)
|
||||
goto bad;
|
||||
}
|
||||
|
||||
if (nh->nh_flags & (NHF_BLACKHOLE | NHF_REJECT)) {
|
||||
IP6STAT_INC(ip6s_cantforward);
|
||||
if ((nh->nh_flags & NHF_REJECT) && (mcopy != NULL)) {
|
||||
icmp6_error(mcopy, ICMP6_DST_UNREACH,
|
||||
ICMP6_DST_UNREACH_REJECT, 0);
|
||||
}
|
||||
goto bad;
|
||||
}
|
||||
|
||||
/*
|
||||
* Source scope check: if a packet can't be delivered to its
|
||||
* destination for the reason that the destination is beyond the scope
|
||||
|
Loading…
Reference in New Issue
Block a user